Question regarding configuration of shibboleth using NativeSPBackDoor

[Chu, Man Sin]

Hi Scott,

Sorry for not explaining clearly.  I have installed shibboleth service provider 2.4.3 and the isapi is up and running on iis.  I am able to get to the status page.  So installation with default configuration is working.  I am not sure how to configure it as one way authentication where the idp sent us the request and does not expect us to send them back a handshake.  As in the statement below:

" we were expecting to execute an IdP-initiated browser POSTed assertion to you, which should not require you to send any response back to us. Basically, our Total Rewards site will generate a SAML Response containing an assertion that we will POST to whatever consumer URL endpoint you provide, and you will take in and process that SAML assertion and route the user accordingly (assuming you are able to consume the assertion we send)."

That seem to me is a one way authentication.  That is why I thought nativespbackdoor is the correct way.  Obviously I am so wrong about that

Regards,
Man Chu


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, June 27, 2012 4:17 PM
To: Shib Users
Subject: Re: Question regarding configuration of shibboleth using NativeSPBackDoor

On 6/27/12 4:08 PM, "Chu, Man Sin" <ManSin.Chu at alliancebernstein.com>
wrote:

>  I have a vendor that will execute an IdP-initiated browser POSTed 
>assertion  to me (Service Provider).

That is not what this feature is for.

>  I need to process this SAML assertion and route it to an internal site.

Why? For what purpose? The assertion is meant to be processed by an SP implementation, not by your internal site.

>  They gave me a metadata file containing x.509 certificate.  From what 
>I read on the shibboleth document, It indicating that I should use 
>NativeSPBackDoor.

No, you shouldn't. That isn't even released yet, it's a beta release feature. It isn't anything to do with normal SAML usage, it's for integrating non-SAML mechanisms into the system.

The metadata file they gave you is how you provision the SP with what it needs to communicate with that IdP. The wiki explains how to install the software and how to configure it to communicate that an IdP.


> 
> I am running iis6.0.  I am not sure how to configure this.

IIS installation and use is documented, so unless you want to explain what it is you don't understand in the existing documentation, there's not much else I can do.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
............................................................................

For further important information about AllianceBernstein please click here
http://www.alliancebernstein.com/disclaimer/email/disclaimer.html